e8c39d19a7
[Rule Tuning] Missing MITRE ATT&CK Mappings ( #2073 )
...
* initial commit with eggshell mitre mapping added
* adding updated rules
* [Rule Tuning] MITRE for GCP rules
I've added Mitre references for the 4 GCP rules missing. Changed 3 of the rules from "Impact" to "Defense Evasion" based on the technique used and it's matched tactic.
* [Rule Tuning] Endgame Rule name updates for Mitre
Updated Endgame rule names for those with Mitre tactics to match the tactics.
* Update rules/integrations/aws/persistence_redshift_instance_creation.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
* Update rules/integrations/aws/exfiltration_rds_snapshot_restored.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
* adding 10 updated rules for google_workspace, ml and o365
* adding 22 rule updates for mitre att&ck mappings
* adding 24 rule updates related mainly to ML rules
* adding 3 rules related to detection via ML
* adding adjustments
* adding adjustments with solutions to recent pytest errors
* removed tabs from tags
* adjusted mappings and added techniques
* adjusted endgame rule mappings per review
* adjusted names to match different tactics
* added execution and defense evasion tag
* adjustments to address errors from merging with main
* added newlines to rules missing them at the end of the file
Co-authored-by: imays11 <59296946+imays11@users.noreply.github.com >
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
2022-07-22 14:30:34 -04:00
d312f49117
[New Rule] Suspicious HTML File Creation ( #2068 )
...
* [New Rule] Suspicious HTML File Creation
* Update initial_access_evasion_suspicious_htm_file_creation.toml
* Update non-ecs-schema.json
* Update initial_access_evasion_suspicious_htm_file_creation.toml
* Update rules/windows/initial_access_evasion_suspicious_htm_file_creation.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
2022-07-22 16:21:53 +02:00
d854b943e5
[Security Content] Add Investigation Guides to Cloud Rules - AWS ( #2104 )
...
* [Security Content] Add Investigation Guides to Cloud Rules - AWS
* Apply suggestion from review
* Update rules/integrations/aws/exfiltration_ec2_snapshot_change_activity.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
* Update rules/integrations/aws/impact_cloudwatch_log_stream_deletion.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
* Apply suggestions from review
* Apply suggestions from code review
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
* Apply suggestions from code review
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
* .
* Applies suggestions from the https://github.com/elastic/detection-rules/pull/2124 PR
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
2022-07-20 12:28:58 -03:00
59736e3973
[New Rule] Suspicious LSASS Access via MalSecLogon ( #2063 )
...
* [New Rule]
Identifies suspicious access to LSASS handle from a call trace pointing to seclogon.dll and with a suspicious access rights value, this may indicate an attempt to leak an Lsass handle via abusing the Secondary Logon service in preparation for credential access.
https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html
Data:
```
{
"_index": ".ds-logs-windows.sysmon_operational-default-2022.06.16-000005",
"_id": "QxU4rIEBTJjT82fLq8Cf",
"_score": 1,
"_source": {
"agent": {
"name": "02694w-win10",
"id": "85e87161-ea22-4847-a978-fb4ed45ebf0e",
"type": "filebeat",
"ephemeral_id": "137d194a-e542-4cd6-a1e3-f4ca9f5ad6b8",
"version": "8.0.0"
},
"process": {
"name": "svchost.exe",
"pid": 456,
"thread": {
"id": 15264
},
"entity_id": "{6a3c3ef2-3646-62ab-1300-00000000d300}",
"executable": "C:\\WINDOWS\\system32\\svchost.exe"
},
"winlog": {
"computer_name": "02694w-win10.threebeesco.com",
"process": {
"pid": 2680,
"thread": {
"id": 3988
}
},
"channel": "Microsoft-Windows-Sysmon/Operational",
"event_data": {
"GrantedAccess": "0x14c0",
"TargetProcessId": "680",
"SourceUser": "NT AUTHORITY\\SYSTEM",
"TargetImage": "C:\\WINDOWS\\system32\\lsass.exe",
"CallTrace": "C:\\WINDOWS\\SYSTEM32\\ntdll.dll+9c534|C:\\WINDOWS\\System32\\KERNELBASE.dll+2726e|c:\\windows\\system32\\seclogon.dll+128f|c:\\windows\\system32\\seclogon.dll+10a0|C:\\WINDOWS\\System32\\RPCRT4.dll+76953|C:\\WINDOWS\\System32\\RPCRT4.dll+da036|C:\\WINDOWS\\System32\\RPCRT4.dll+37a4c|C:\\WINDOWS\\System32\\RPCRT4.dll+548c8|C:\\WINDOWS\\System32\\RPCRT4.dll+2c921|C:\\WINDOWS\\System32\\RPCRT4.dll+2c1db|C:\\WINDOWS\\System32\\RPCRT4.dll+1a86f|C:\\WINDOWS\\System32\\RPCRT4.dll+19d1a|C:\\WINDOWS\\System32\\RPCRT4.dll+19301|C:\\WINDOWS\\System32\\RPCRT4.dll+18d6e|C:\\WINDOWS\\System32\\RPCRT4.dll+169a5|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+333ed|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+34142|C:\\WINDOWS\\System32\\KERNEL32.DLL+17bd4|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+6ce51",
"TargetProcessGUID": "{6a3c3ef2-3646-62ab-0c00-00000000d300}",
"TargetUser": "NT AUTHORITY\\SYSTEM"
},
"opcode": "Info",
"version": 3,
"record_id": "1825496",
"task": "Process accessed (rule: ProcessAccess)",
"event_id": "10",
"provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}",
"api": "wineventlog",
"provider_name": "Microsoft-Windows-Sysmon",
"user": {
"identifier": "S-1-5-18",
"domain": "NT AUTHORITY",
"name": "SYSTEM",
"type": "User"
}
},
"log": {
"level": "information"
},
"elastic_agent": {
"id": "85e87161-ea22-4847-a978-fb4ed45ebf0e",
"version": "8.0.0",
"snapshot": false
},
"message": "Process accessed:\nRuleName: -\nUtcTime: 2022-06-28 21:29:49.829\nSourceProcessGUID: {6a3c3ef2-3646-62ab-1300-00000000d300}\nSourceProcessId: 456\nSourceThreadId: 15264\nSourceImage: C:\\WINDOWS\\system32\\svchost.exe\nTargetProcessGUID: {6a3c3ef2-3646-62ab-0c00-00000000d300}\nTargetProcessId: 680\nTargetImage: C:\\WINDOWS\\system32\\lsass.exe\nGrantedAccess: 0x14C0\nCallTrace: C:\\WINDOWS\\SYSTEM32\\ntdll.dll+9c534|C:\\WINDOWS\\System32\\KERNELBASE.dll+2726e|c:\\windows\\system32\\seclogon.dll+128f|c:\\windows\\system32\\seclogon.dll+10a0|C:\\WINDOWS\\System32\\RPCRT4.dll+76953|C:\\WINDOWS\\System32\\RPCRT4.dll+da036|C:\\WINDOWS\\System32\\RPCRT4.dll+37a4c|C:\\WINDOWS\\System32\\RPCRT4.dll+548c8|C:\\WINDOWS\\System32\\RPCRT4.dll+2c921|C:\\WINDOWS\\System32\\RPCRT4.dll+2c1db|C:\\WINDOWS\\System32\\RPCRT4.dll+1a86f|C:\\WINDOWS\\System32\\RPCRT4.dll+19d1a|C:\\WINDOWS\\System32\\RPCRT4.dll+19301|C:\\WINDOWS\\System32\\RPCRT4.dll+18d6e|C:\\WINDOWS\\System32\\RPCRT4.dll+169a5|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+333ed|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+34142|C:\\WINDOWS\\System32\\KERNEL32.DLL+17bd4|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+6ce51\nSourceUser: NT AUTHORITY\\SYSTEM\nTargetUser: NT AUTHORITY\\SYSTEM",
"input": {
"type": "winlog"
},
"@timestamp": "2022-06-28T21:29:49.829Z",
"ecs": {
"version": "1.12.0"
},
"data_stream": {
"namespace": "default",
"type": "logs",
"dataset": "windows.sysmon_operational"
},
"host": {
"hostname": "02694w-win10",
"os": {
"build": "18363.815",
"kernel": "10.0.18362.815 (WinBuild.160101.0800)",
"name": "Windows 10 Enterprise",
"type": "windows",
"family": "windows",
"version": "10.0",
"platform": "windows"
},
"ip": [
"fe80::7587:a5c1:5a7b:68f6",
"172.16.66.25"
],
"name": "02694w-win10.threebeesco.com",
"id": "6a3c3ef2-208f-4d6f-90ee-b34f4e3fd160",
"mac": [
"00:50:56:03:c6:93"
],
"architecture": "x86_64"
},
"event": {
"agent_id_status": "verified",
"ingested": "2022-06-28T21:30:04Z",
"code": "10",
"provider": "Microsoft-Windows-Sysmon",
"created": "2022-06-28T21:29:51.107Z",
"kind": "event",
"action": "Process accessed (rule: ProcessAccess)",
"category": [
"process"
],
"type": [
"access"
],
"dataset": "windows.sysmon_operational"
},
"user": {
"id": "S-1-5-18"
}
},
"fields": {
"elastic_agent.version": [
"8.0.0"
],
"event.category": [
"process"
],
"host.os.name.text": [
"Windows 10 Enterprise"
],
"winlog.provider_guid": [
"{5770385f-c22a-43e0-bf4c-06f5698ffbd9}"
],
"winlog.provider_name": [
"Microsoft-Windows-Sysmon"
],
"host.hostname": [
"02694w-win10"
],
"winlog.computer_name": [
"02694w-win10.threebeesco.com"
],
"process.pid": [
456
],
"host.mac": [
"00:50:56:03:c6:93"
],
"winlog.process.pid": [
2680
],
"host.os.version": [
"10.0"
],
"winlog.record_id": [
"1825496"
],
"winlog.event_data.TargetUser": [
"NT AUTHORITY\\SYSTEM"
],
"host.os.name": [
"Windows 10 Enterprise"
],
"log.level": [
"information"
],
"agent.name": [
"02694w-win10"
],
"host.name": [
"02694w-win10.threebeesco.com"
],
"event.agent_id_status": [
"verified"
],
"event.kind": [
"event"
],
"winlog.version": [
3
],
"host.os.type": [
"windows"
],
"user.id": [
"S-1-5-18"
],
"input.type": [
"winlog"
],
"data_stream.type": [
"logs"
],
"host.architecture": [
"x86_64"
],
"process.name": [
"svchost.exe"
],
"event.provider": [
"Microsoft-Windows-Sysmon"
],
"event.code": [
"10"
],
"agent.id": [
"85e87161-ea22-4847-a978-fb4ed45ebf0e"
],
"ecs.version": [
"1.12.0"
],
"event.created": [
"2022-06-28T21:29:51.107Z"
],
"winlog.event_data.CallTrace": [
"C:\\WINDOWS\\SYSTEM32\\ntdll.dll+9c534|C:\\WINDOWS\\System32\\KERNELBASE.dll+2726e|c:\\windows\\system32\\seclogon.dll+128f|c:\\windows\\system32\\seclogon.dll+10a0|C:\\WINDOWS\\System32\\RPCRT4.dll+76953|C:\\WINDOWS\\System32\\RPCRT4.dll+da036|C:\\WINDOWS\\System32\\RPCRT4.dll+37a4c|C:\\WINDOWS\\System32\\RPCRT4.dll+548c8|C:\\WINDOWS\\System32\\RPCRT4.dll+2c921|C:\\WINDOWS\\System32\\RPCRT4.dll+2c1db|C:\\WINDOWS\\System32\\RPCRT4.dll+1a86f|C:\\WINDOWS\\System32\\RPCRT4.dll+19d1a|C:\\WINDOWS\\System32\\RPCRT4.dll+19301|C:\\WINDOWS\\System32\\RPCRT4.dll+18d6e|C:\\WINDOWS\\System32\\RPCRT4.dll+169a5|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+333ed|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+34142|C:\\WINDOWS\\System32\\KERNEL32.DLL+17bd4|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+6ce51"
],
"agent.version": [
"8.0.0"
],
"host.os.family": [
"windows"
],
"process.thread.id": [
15264
],
"winlog.event_data.TargetProcessGUID": [
"{6a3c3ef2-3646-62ab-0c00-00000000d300}"
],
"winlog.process.thread.id": [
3988
],
"winlog.event_data.TargetImage": [
"C:\\WINDOWS\\system32\\lsass.exe"
],
"winlog.event_data.TargetProcessId": [
"680"
],
"process.entity_id": [
"{6a3c3ef2-3646-62ab-1300-00000000d300}"
],
"host.os.build": [
"18363.815"
],
"winlog.user.type": [
"User"
],
"host.ip": [
"fe80::7587:a5c1:5a7b:68f6",
"172.16.66.25"
],
"agent.type": [
"filebeat"
],
"event.module": [
"windows"
],
"host.os.kernel": [
"10.0.18362.815 (WinBuild.160101.0800)"
],
"winlog.api": [
"wineventlog"
],
"elastic_agent.snapshot": [
false
],
"host.id": [
"6a3c3ef2-208f-4d6f-90ee-b34f4e3fd160"
],
"process.executable": [
"C:\\WINDOWS\\system32\\svchost.exe"
],
"winlog.user.identifier": [
"S-1-5-18"
],
"winlog.event_data.SourceUser": [
"NT AUTHORITY\\SYSTEM"
],
"winlog.task": [
"Process accessed (rule: ProcessAccess)"
],
"winlog.user.domain": [
"NT AUTHORITY"
],
"elastic_agent.id": [
"85e87161-ea22-4847-a978-fb4ed45ebf0e"
],
"data_stream.namespace": [
"default"
],
"winlog.event_data.GrantedAccess": [
"0x14c0"
],
"message": [
"Process accessed:\nRuleName: -\nUtcTime: 2022-06-28 21:29:49.829\nSourceProcessGUID: {6a3c3ef2-3646-62ab-1300-00000000d300}\nSourceProcessId: 456\nSourceThreadId: 15264\nSourceImage: C:\\WINDOWS\\system32\\svchost.exe\nTargetProcessGUID: {6a3c3ef2-3646-62ab-0c00-00000000d300}\nTargetProcessId: 680\nTargetImage: C:\\WINDOWS\\system32\\lsass.exe\nGrantedAccess: 0x14C0\nCallTrace: C:\\WINDOWS\\SYSTEM32\\ntdll.dll+9c534|C:\\WINDOWS\\System32\\KERNELBASE.dll+2726e|c:\\windows\\system32\\seclogon.dll+128f|c:\\windows\\system32\\seclogon.dll+10a0|C:\\WINDOWS\\System32\\RPCRT4.dll+76953|C:\\WINDOWS\\System32\\RPCRT4.dll+da036|C:\\WINDOWS\\System32\\RPCRT4.dll+37a4c|C:\\WINDOWS\\System32\\RPCRT4.dll+548c8|C:\\WINDOWS\\System32\\RPCRT4.dll+2c921|C:\\WINDOWS\\System32\\RPCRT4.dll+2c1db|C:\\WINDOWS\\System32\\RPCRT4.dll+1a86f|C:\\WINDOWS\\System32\\RPCRT4.dll+19d1a|C:\\WINDOWS\\System32\\RPCRT4.dll+19301|C:\\WINDOWS\\System32\\RPCRT4.dll+18d6e|C:\\WINDOWS\\System32\\RPCRT4.dll+169a5|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+333ed|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+34142|C:\\WINDOWS\\System32\\KERNEL32.DLL+17bd4|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+6ce51\nSourceUser: NT AUTHORITY\\SYSTEM\nTargetUser: NT AUTHORITY\\SYSTEM"
],
"winlog.user.name": [
"SYSTEM"
],
"winlog.event_id": [
"10"
],
"event.ingested": [
"2022-06-28T21:30:04.000Z"
],
"event.action": [
"Process accessed (rule: ProcessAccess)"
],
"@timestamp": [
"2022-06-28T21:29:49.829Z"
],
"winlog.channel": [
"Microsoft-Windows-Sysmon/Operational"
],
"host.os.platform": [
"windows"
],
"data_stream.dataset": [
"windows.sysmon_operational"
],
"event.type": [
"access"
],
"winlog.opcode": [
"Info"
],
"agent.ephemeral_id": [
"137d194a-e542-4cd6-a1e3-f4ca9f5ad6b8"
],
"event.dataset": [
"windows.sysmon_operational"
]
}
}
```
* Update rules/windows/credential_access_lsass_handle_via_malseclogon.toml
* Update rules/windows/credential_access_lsass_handle_via_malseclogon.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
2022-07-20 16:30:19 +02:00
a52751494e
2058 add setup field to metadata ( #2061 )
...
* Convert config header to setup in note field
* Parse note field into separate setup and note field with marko gfm
* only validate and parse note on elastic authored rules and add CLI description for new DR_BYPASS_NOTE_VALIDATION_AND_PARSE environment variable
Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com >
2022-07-18 15:41:32 -04:00
3a8efc8183
[Security Content] 8.4 - Add Investigation Guides ( #2069 )
...
* [Security Content] 8.4 - Add Investigation Guides
* Apply suggestions from code review
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
* Update rules/windows/credential_access_cmdline_dump_tool.toml
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
* Apply suggestions from code review
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
* Update rules/windows/credential_access_credential_dumping_msbuild.toml
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
2022-07-13 11:28:34 -03:00
329530c8c3
[New Rule] Domain Trust Enumeration via Nltest ( #2010 )
...
* adding detection rule
* removed changes from unrelated rule
* adjusted threat technique
* Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml
* Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
* Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
* Update rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2022-07-05 10:48:25 -04:00
853f8db8d0
Update discovery_privileged_localgroup_membership.toml ( #2046 )
2022-06-30 14:26:17 -03:00
c8ff1dc9cb
Update discovery_remote_system_discovery_commands_windows.toml ( #2033 )
2022-06-14 10:50:59 -03:00
b6631f200e
Update persistence_sdprop_exclusion_dsheuristics.toml ( #2017 )
2022-06-03 14:22:04 -03:00
f857e009c5
Adds logs-system.* index pattern ( #2016 )
2022-06-03 13:56:54 -03:00
d6e96a83d5
[New Rule] Suspicious Microsoft Diagnostics Wizard Execution ( #2005 )
...
* [New Rule] Suspicious Microsoft Diagnostics Wizard Execution
https://lolbas-project.github.io/lolbas/Binaries/Msdt/
https://twitter.com/nao_sec/status/1530196847679401984
* Update rules/windows/defense_evasion_proxy_execution_via_msdt.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
2022-06-01 17:02:47 +02:00
27f5c2e695
[Security Content] 8.3 Add Investigation Guides - 3 ( #1990 )
...
* [Security Content] 8.3 Add Investigation Guides - 3
* bump date
* Apply suggestions from code review
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
* Apply suggestions from code review
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
2022-05-31 12:57:02 -03:00
e5d3c6329c
[Security Content] 8.3 - Add Investigation Guides 2 ( #1989 )
...
* [Security Content] 8.3 - Add Investigation Guides 2 - Initial Commit
* .
* Add Related rules
* Apply suggestions from code review
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
* Apply suggestions from code review
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
* .
* .
* Apply suggestions from code review
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
2022-05-31 12:54:42 -03:00
bfea11c99f
[Rule Tuning] Suspicious MS Office Child Process ( #2003 )
...
added msdt.exe as a response to this in the wild 0day (works without vba and on latest office) ->
https://twitter.com/nao_sec/status/1530196847679401984
https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
2022-05-31 14:20:51 +02:00
1f8813d02f
[Promote Rule] Potential Invoke-Mimikatz PowerShell Script ( #1993 )
...
* Update credential_access_mimikatz_powershell_module.toml
* Update credential_access_mimikatz_powershell_module.toml
* Update credential_access_mimikatz_powershell_module.toml
* Update credential_access_mimikatz_powershell_module.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
2022-05-25 17:02:21 -03:00
72c186b30b
[Rule tuning] Whitespace Padding in Process Command Line ( #1967 )
...
* [Rule tuning] Whitespace Padding in Process Command Line
* bump updated_date
* update comment
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
2022-05-23 14:33:48 -05:00
a1bdf2b564
[Security Content] 8.3 - Add Investigation Guides ( #1937 )
...
* 8.3 - Add Investigation Guides
* Apply suggestions
* Apply the refactor
* Apply suggestions from Samir
* .
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
2022-05-19 13:23:35 -03:00
817b97f428
[Security Content] Refactor Existing Investigation Guides ( #1959 )
...
* Initial commit
* Update Investigation guides - security-docs review
* Update command_and_control_dns_tunneling_nslookup.toml
* Update defense_evasion_amsienable_key_mod.toml
* Apply security-docs review
* Remove dot
* Update rules/windows/command_and_control_rdp_tunnel_plink.toml
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
* Apply changes from review
* Apply the suggestion
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
2022-05-18 12:59:39 -03:00
27e6632ecd
Update command_and_control_common_webservices.toml ( #1970 )
2022-05-16 14:04:26 -03:00
19ff825a91
[New rule] Remote Computer Account DnsHostName Update ( #1962 )
...
* [New rule] Remote Computer Account DnsHostName Update
Identifies remote update to a computer account DnsHostName attribute, if the new value is set a valid domain controller DNS hostname and the subject computer name is not a domain controller then it's high likely a preparation step to exploit CVE-2022-26923 in an attempt to elevate privileges from a standard domain user to domain admin privileges :
* added MS ref url
* Update rules/windows/privilege_escalation_suspicious_dnshostname_update.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
* Update rules/windows/privilege_escalation_suspicious_dnshostname_update.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
2022-05-11 19:40:34 +02:00
03836d45fa
[New Rule] Potential Local NTLM Relay via HTTP ( #1947 )
...
* [New Rule] Potential Local NTLM Relay via HTTP
Detect attempt to elevate privileges via coercing a privileged service to connect to a local rogue HTTP endpoint, leading to NTLM relay, example of logs while testing https://github.com/med0x2e/NTLMRelay2Self (step 5):
* Update credential_access_relay_ntlm_auth_via_http_spoolss.toml
* Update credential_access_relay_ntlm_auth_via_http_spoolss.toml
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
2022-05-06 21:07:27 +02:00
e9f5585a9f
[Rule Tuning] Update Rule Content Changes from Security Docs Team ( #1945 )
...
* updated content to reflect changes from Security Docs team
* Update rules/linux/execution_flock_binary.toml
* Update rules/linux/execution_expect_binary.toml
* TOML linting
* added escape for crdential_access_spn_attribute_modified.toml
2022-05-06 13:21:12 -04:00
3f047b987e
[New Rule] Service Creation via Local Kerberos Authentication ( #1941 )
...
* [New Rule] Suspicious Service Creation via Local Kerberos Relay over LDAP
This rule will catch also the suspicious service that was created leveraging the imported kerberos ticket https://gist.github.com/tyranid/c24cfd1bd141d14d4925043ee7e03c82 which makes triage easier :
DATA :
```
"sequences" : [
{
"join_keys" : [
"6a3c3ef2-208f-4d6f-90ee-b34f4e3fd160",
"0xefac5f"
],
"events" : [
{
"_index" : ".ds-logs-system.security-default-2022.04.12-000003",
"_id" : "XAy1YoABQhClK0XGpqaL",
"_source" : {
"agent" : {
"name" : "02694w-win10",
"id" : "77a829ec-a564-44d5-9bc4-61eeefbf783a",
"type" : "filebeat",
"ephemeral_id" : "6c751494-97a3-46aa-bab2-5baf01d17d04",
"version" : "8.0.0"
},
"process" : {
"name" : "-",
"pid" : 0,
"executable" : "-"
},
"winlog" : {
"computer_name" : "02694w-win10.threebeesco.com",
"process" : {
"pid" : 688,
"thread" : {
"id" : 5160
}
},
"keywords" : [
"Audit Success"
],
"logon" : {
"id" : "0x0",
"type" : "Network"
},
"channel" : "Security",
"event_data" : {
"LogonGuid" : "{82d3503b-9dac-ab6d-b045-8877b5aab051}",
"TargetOutboundDomainName" : "-",
"VirtualAccount" : "%%1843",
"LogonType" : "3",
"TransmittedServices" : "-",
"SubjectLogonId" : "0x0",
"LmPackageName" : "-",
"TargetOutboundUserName" : "-",
"KeyLength" : "0",
"RestrictedAdminMode" : "-",
"TargetLogonId" : "0xefac5f",
"SubjectUserName" : "-",
"TargetLinkedLogonId" : "0x0",
"ElevatedToken" : "%%1842",
"SubjectDomainName" : "-",
"ImpersonationLevel" : "%%1833",
"TargetUserName" : "Administrator",
"TargetDomainName" : "THREEBEESCO.COM",
"LogonProcessName" : "Kerberos",
"SubjectUserSid" : "S-1-0-0",
"TargetUserSid" : "S-1-5-21-308926384-506822093-3341789130-500",
"AuthenticationPackageName" : "Kerberos"
},
"opcode" : "Info",
"version" : 2,
"record_id" : "59330",
"task" : "Logon",
"event_id" : "4624",
"provider_guid" : "{54849625-5478-4994-a5ba-3e3b0328c30d}",
"activity_id" : "{e22af019-58dd-0002-43f0-2ae2dd58d801}",
"api" : "wineventlog",
"provider_name" : "Microsoft-Windows-Security-Auditing"
},
"log" : {
"level" : "information"
},
"elastic_agent" : {
"id" : "77a829ec-a564-44d5-9bc4-61eeefbf783a",
"version" : "8.0.0",
"snapshot" : false
},
"source" : {
"port" : 50494,
"ip" : "127.0.0.1",
"domain" : "-"
},
"message" : """An account was successfully logged on.
Subject:
Security ID: S-1-0-0
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Information:
Logon Type: 3
Restricted Admin Mode: -
Virtual Account: No
Elevated Token: Yes
Impersonation Level: Impersonation
New Logon:
Security ID: S-1-5-21-308926384-506822093-3341789130-500
Account Name: Administrator
Account Domain: THREEBEESCO.COM
Logon ID: 0xEFAC5F
Linked Logon ID: 0x0
Network Account Name: -
Network Account Domain: -
Logon GUID: {82d3503b-9dac-ab6d-b045-8877b5aab051}
Process Information:
Process ID: 0x0
Process Name: -
Network Information:
Workstation Name: -
Source Network Address: 127.0.0.1
Source Port: 50494
Detailed Authentication Information:
Logon Process: Kerberos
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The impersonation level field indicates the extent to which a process in the logon session can impersonate.
The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.""",
"input" : {
"type" : "winlog"
},
"@timestamp" : "2022-04-25T21:09:04.559Z",
"ecs" : {
"version" : "1.12.0"
},
"related" : {
"ip" : [
"127.0.0.1"
],
"user" : [
"Administrator"
]
},
"data_stream" : {
"namespace" : "default",
"type" : "logs",
"dataset" : "system.security"
},
"host" : {
"hostname" : "02694w-win10",
"os" : {
"build" : "18363.815",
"kernel" : "10.0.18362.815 (WinBuild.160101.0800)",
"name" : "Windows 10 Enterprise",
"family" : "windows",
"type" : "windows",
"version" : "10.0",
"platform" : "windows"
},
"ip" : [
"fe80::7587:a5c1:5a7b:68f6",
"172.16.66.25"
],
"name" : "02694w-win10.threebeesco.com",
"id" : "6a3c3ef2-208f-4d6f-90ee-b34f4e3fd160",
"mac" : [
"00:50:56:03:c6:93"
],
"architecture" : "x86_64"
},
"event" : {
"agent_id_status" : "verified",
"ingested" : "2022-04-25T21:51:53Z",
"code" : "4624",
"provider" : "Microsoft-Windows-Security-Auditing",
"kind" : "event",
"created" : "2022-04-25T21:51:15.561Z",
"action" : "logged-in",
"category" : [
"authentication"
],
"type" : [
"start"
],
"dataset" : "system.security",
"outcome" : "success"
},
"user" : {
"domain" : "THREEBEESCO.COM",
"name" : "Administrator",
"id" : "S-1-5-21-308926384-506822093-3341789130-500"
}
}
},
{
"_index" : ".ds-logs-system.security-default-2022.04.12-000003",
"_id" : "Xwy1YoABQhClK0XGpqaL",
"_source" : {
"agent" : {
"name" : "02694w-win10",
"id" : "77a829ec-a564-44d5-9bc4-61eeefbf783a",
"ephemeral_id" : "6c751494-97a3-46aa-bab2-5baf01d17d04",
"type" : "filebeat",
"version" : "8.0.0"
},
"winlog" : {
"computer_name" : "02694w-win10.threebeesco.com",
"process" : {
"pid" : 688,
"thread" : {
"id" : 5160
}
},
"keywords" : [
"Audit Success"
],
"logon" : {
"id" : "0xefac5f"
},
"channel" : "Security",
"event_data" : {
"ServiceAccount" : "LocalSystem",
"SubjectUserName" : "Administrator",
"ServiceStartType" : "3",
"ServiceName" : "KrbSCM",
"ServiceType" : "0x10",
"SubjectDomainName" : "3B",
"SubjectLogonId" : "0xefac5f",
"SubjectUserSid" : "S-1-5-21-308926384-506822093-3341789130-500",
"ServiceFileName" : "\"C:\\Users\\lgreen\\Downloads\\KrbRelayUp.exe\" system 1"
},
"opcode" : "Info",
"record_id" : "59331",
"task" : "Security System Extension",
"event_id" : "4697",
"provider_guid" : "{54849625-5478-4994-a5ba-3e3b0328c30d}",
"activity_id" : "{e22af019-58dd-0002-43f0-2ae2dd58d801}",
"api" : "wineventlog",
"provider_name" : "Microsoft-Windows-Security-Auditing"
},
"log" : {
"level" : "information"
},
"elastic_agent" : {
"id" : "77a829ec-a564-44d5-9bc4-61eeefbf783a",
"version" : "8.0.0",
"snapshot" : false
},
"message" : """A service was installed in the system.
Subject:
Security ID: S-1-5-21-308926384-506822093-3341789130-500
Account Name: Administrator
Account Domain: 3B
Logon ID: 0xEFAC5F
Service Information:
Service Name: KrbSCM
Service File Name: "C:\Users\lgreen\Downloads\KrbRelayUp.exe" system 1
Service Type: 0x10
Service Start Type: 3
Service Account: LocalSystem""",
"input" : {
"type" : "winlog"
},
"@timestamp" : "2022-04-25T21:09:04.561Z",
"ecs" : {
"version" : "1.12.0"
},
"related" : {
"user" : [
"Administrator"
]
},
"data_stream" : {
"namespace" : "default",
"type" : "logs",
"dataset" : "system.security"
},
"service" : {
"name" : "KrbSCM",
"type" : "Win32 Own Process"
},
"host" : {
"hostname" : "02694w-win10",
"os" : {
"build" : "18363.815",
"kernel" : "10.0.18362.815 (WinBuild.160101.0800)",
"name" : "Windows 10 Enterprise",
"family" : "windows",
"type" : "windows",
"version" : "10.0",
"platform" : "windows"
},
"ip" : [
"fe80::7587:a5c1:5a7b:68f6",
"172.16.66.25"
],
"name" : "02694w-win10.threebeesco.com",
"id" : "6a3c3ef2-208f-4d6f-90ee-b34f4e3fd160",
"mac" : [
"00:50:56:03:c6:93"
],
"architecture" : "x86_64"
},
"event" : {
"agent_id_status" : "verified",
"ingested" : "2022-04-25T21:51:53Z",
"code" : "4697",
"provider" : "Microsoft-Windows-Security-Auditing",
"created" : "2022-04-25T21:51:15.561Z",
"kind" : "event",
"action" : "service-installed",
"category" : [
"iam",
"configuration"
],
"type" : [
"admin",
"change"
],
"dataset" : "system.security",
"outcome" : "success"
},
"user" : {
"domain" : "3B",
"name" : "Administrator",
"id" : "S-1-5-21-308926384-506822093-3341789130-500"
}
}
}
]
````
* Update privilege_escalation_krbrelayup_service_creation.toml
* removed duplicate SubjectLogonId from non ecs fields list
2022-04-29 14:36:28 +02:00
a0672c7d2a
[New Rule] Potential Privileged Escalation via KrbRelayUp ( #1940 )
...
* [New Rule] Potential Privileged Escalation via KrbRelayUp
Identifies a suspicious local successful logon event where the Logon Package is kerberos, the remote address is set to localhost and the target user SID is the builtin local Administrator account, this may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from filtered administrator token to a token with full System privileges.
https://github.com/Dec0ne/KrbRelayUp
DATA :
```
{
"_index" : ".ds-logs-system.security-default-2022.04.12-000003",
"_id" : "Cwy1YoABQhClK0XGfqEU",
"_source" : {
"agent" : {
"name" : "02694w-win10",
"id" : "77a829ec-a564-44d5-9bc4-61eeefbf783a",
"type" : "filebeat",
"ephemeral_id" : "6c751494-97a3-46aa-bab2-5baf01d17d04",
"version" : "8.0.0"
},
"process" : {
"name" : "-",
"pid" : 0,
"executable" : "-"
},
"winlog" : {
"computer_name" : "02694w-win10.corpcorp.com",
"process" : {
"pid" : 688,
"thread" : {
"id" : 9384
}
},
"keywords" : [
"Audit Success"
],
"logon" : {
"id" : "0x0",
"type" : "Network"
},
"channel" : "Security",
"event_data" : {
"LogonGuid" : "{daac0d7c-3273-752c-bf5d-ea1c60851819}",
"TargetOutboundDomainName" : "-",
"VirtualAccount" : "%%1843",
"LogonType" : "3",
"TransmittedServices" : "-",
"SubjectLogonId" : "0x0",
"LmPackageName" : "-",
"TargetOutboundUserName" : "-",
"KeyLength" : "0",
"RestrictedAdminMode" : "-",
"TargetLogonId" : "0xebd3d4",
"SubjectUserName" : "-",
"TargetLinkedLogonId" : "0x0",
"ElevatedToken" : "%%1842",
"SubjectDomainName" : "-",
"TargetUserName" : "Administrator",
"ImpersonationLevel" : "%%1833",
"LogonProcessName" : "Kerberos",
"TargetDomainName" : "CORPCORP.COM",
"SubjectUserSid" : "S-1-0-0",
"AuthenticationPackageName" : "Kerberos",
"TargetUserSid" : "S-1-5-21-308926384-506822093-3341789130-500"
},
"opcode" : "Info",
"version" : 2,
"record_id" : "59063",
"task" : "Logon",
"event_id" : "4624",
"provider_guid" : "{54849625-5478-4994-a5ba-3e3b0328c30d}",
"activity_id" : "{e22af019-58dd-0002-43f0-2ae2dd58d801}",
"api" : "wineventlog",
"provider_name" : "Microsoft-Windows-Security-Auditing"
},
"log" : {
"level" : "information"
},
"elastic_agent" : {
"id" : "77a829ec-a564-44d5-9bc4-61eeefbf783a",
"version" : "8.0.0",
"snapshot" : false
},
"source" : {
"port" : 50480,
"ip" : "127.0.0.1",
"domain" : "-"
},
"message" : """An account was successfully logged on.
Subject:
Security ID: S-1-0-0
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Information:
Logon Type: 3
Restricted Admin Mode: -
Virtual Account: No
Elevated Token: Yes
Impersonation Level: Impersonation
New Logon:
Security ID: S-1-5-21-308926384-506822093-3341789130-500
Account Name: Administrator
Account Domain: CORPCORP.COM
Logon ID: 0xEBD3D4
Linked Logon ID: 0x0
Network Account Name: -
Network Account Domain: -
Logon GUID: {daac0d7c-3273-752c-bf5d-ea1c60851819}
Process Information:
Process ID: 0x0
Process Name: -
Network Information:
Workstation Name: -
Source Network Address: 127.0.0.1
Source Port: 50480
Detailed Authentication Information:
Logon Process: Kerberos
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon session is created. It is generated on the computer that was accessed.
The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).
The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.
The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The impersonation level field indicates the extent to which a process in the logon session can impersonate.
The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.""",
"input" : {
"type" : "winlog"
},
"@timestamp" : "2022-04-25T21:07:15.306Z",
"ecs" : {
"version" : "1.12.0"
},
"related" : {
"ip" : [
"127.0.0.1"
],
"user" : [
"Administrator"
]
},
"data_stream" : {
"namespace" : "default",
"type" : "logs",
"dataset" : "system.security"
},
"host" : {
"hostname" : "02694w-win10",
"os" : {
"build" : "18363.815",
"kernel" : "10.0.18362.815 (WinBuild.160101.0800)",
"name" : "Windows 10 Enterprise",
"family" : "windows",
"type" : "windows",
"version" : "10.0",
"platform" : "windows"
},
"ip" : [
"fe80::7587:a5c1:5a7b:68f6",
"172.16.66.25"
],
"name" : "02694w-win10.corpcorp.com",
"id" : "6a3c3ef2-208f-4d6f-90ee-b34f4e3fd160",
"mac" : [
"00:50:56:03:c6:93"
],
"architecture" : "x86_64"
},
"event" : {
"agent_id_status" : "verified",
"ingested" : "2022-04-25T21:51:43Z",
"code" : "4624",
"provider" : "Microsoft-Windows-Security-Auditing",
"kind" : "event",
"created" : "2022-04-25T21:51:08.433Z",
"action" : "logged-in",
"category" : [
"authentication"
],
"type" : [
"start"
],
"dataset" : "system.security",
"outcome" : "success"
},
"user" : {
"domain" : "CORPCORP.COM",
"name" : "Administrator",
"id" : "S-1-5-21-308926384-506822093-3341789130-500"
}
}
}
```
* Update privilege_escalation_krbrelayup_suspicious_logon.toml
* Update privilege_escalation_krbrelayup_suspicious_logon.toml
* Update privilege_escalation_krbrelayup_suspicious_logon.toml
* Update privilege_escalation_krbrelayup_suspicious_logon.toml
* Update privilege_escalation_krbrelayup_suspicious_logon.toml
* Update rules/windows/privilege_escalation_krbrelayup_suspicious_logon.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
* Update rules/windows/privilege_escalation_krbrelayup_suspicious_logon.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Update etc/non-ecs-schema.json
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* relinted
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2022-04-27 01:39:54 +02:00
20d2e92cfe
Review & Fix Invalid References ( #1936 )
2022-04-26 17:57:15 -03:00
5bf321a505
[Rule Tuning] Exclude MS OneDrive/Teams from Component Object Model Hijacking ( #1932 )
...
* adjusted query to exclude OneDrive process name and MS Teams DLL reference in registry data strings
* adjusted formatting for altered query
* removed unecessary string used for reference
* removed unecessary parenthesis from new filters in query
* Update rules/windows/persistence_suspicious_com_hijack_registry.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
* Update rules/windows/persistence_suspicious_com_hijack_registry.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
* added FileSyncConfig.exe for OneDrive, added regsvr32 to Teams DLL filter
* added investigation notes
* removed comment from original rule creation
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
2022-04-26 11:43:33 -04:00
0943ffba5f
[Rule Tuning] Remove logs-windows.* index ( #1928 )
...
* Remove `logs-windows.*` index
* Update discovery_privileged_localgroup_membership.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2022-04-14 09:25:44 -03:00
258418785f
MInor changes from Investigation Guides Review ( #1927 )
2022-04-13 16:53:29 -08:00
ebeb270075
[Security Content] Current Investigation Guides Review ( #1896 )
...
* Modify investigation guides
* Apply suggestions from code review
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com >
* Update rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com >
* Rewrite and apply previous reviews
* Apply suggestions from code review
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
* Update rules/windows/credential_access_spn_attribute_modified.toml
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com >
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
2022-04-12 22:05:13 -03:00
46f5af436e
[Security Content] Add Investigation Guides - 5 ( #1895 )
...
* [Security Content] Add Investigation Guides - 5
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2022-04-12 16:12:59 -08:00
3a5fceac3b
[Security Content] Add Investigation Guides - 3 ( #1836 )
...
* [Security Content] Add Investigation Guides - 3
* Adjust Investigation Guides and Config
* Adjust Config
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com >
2022-04-12 15:58:50 -08:00
3b6c594a22
Update discovery_net_command_system_account.toml ( #1912 )
2022-04-11 15:03:49 -03:00
290763d9bb
[Security Content] Add Investigation Guides - 4 ( #1871 )
...
* [Security Content] Add Investigation Guides - 4
* Apply suggestions from code review
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
* Update rules/windows/initial_access_script_executing_powershell.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
* lint
* Update persistence_user_account_creation.toml
* Apply suggestions from code review
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
* Apply suggestions from code review
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com >
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
* .
* Fixes and lint
* .
* .
* revert modifications
* Apply suggestions from code review
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
* Update impact_stop_process_service_threshold.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com >
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
2022-04-10 15:37:06 -03:00
49074ddeaa
[Rule Tuning] Add EQL optional field syntax ( #1910 )
...
* Add optional EQL syntax
* Add min_stack_version
2022-04-05 16:32:37 -03:00
6bdfddac8e
Expand timestamp override tests ( #1907 )
...
* Expand timestamp_override tests
* removed timestamp_override from eql sequence rules
* add config entry for eql rules with beats index and t_o
* add timestamp_override to missing fields
2022-04-01 15:27:08 -08:00
93edc44284
[Rule Tuning] Timeline Templates For Windows and Linux ( #1892 )
...
* added comprehensive file timeline to Hosts File Modified rule
* added Comprehensive Process Timeline to Interactive Terminal Spawned via Python rule
* updated rules to have generic instead of comprehensive
* updated several rules with timeline ID and timeline title values
* changed updated_date for threat intel fleet integrations
* added missing templates to timeline_templates dict in definitions.py
* added comprehensive timeline templates to alerts after definitions.py was updated
* updated rules with comprehensive timeline templates and added min stack comments and versions
* removing timeline template changes which is tracked in #1904
* Update rules/linux/execution_python_tty_shell.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
* Delete Pipfile
Removing pipfile
* Delete Pipfile.lock
deleting pipfile.lock
* Update rules/windows/execution_command_shell_started_by_svchost.toml
updating title
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com >
2022-04-01 13:44:35 -04:00
e1b4a0d87c
Svchost spawning Cmd - False Positives Tuning ( #1894 )
2022-03-31 19:28:46 -03:00
8a59b49fea
[Security Content] Adjust Investigation Guides to be less generic ( #1805 )
...
* PowerShell Suspicious Script with Audio Capture Capabilities
* PowerShell Keylogging Script
* PowerShell MiniDump Script
* Potential Process Injection via PowerShell
* PowerShell Suspicious Discovery Related Windows API Functions
* Suspicious Portable Executable Encoded in Powershell Script
* PowerShell PSReflect Script
* Startup/Logon Script added to Group Policy Object
* Group Policy Abuse for Privilege Addition
* Scheduled Task Execution at Scale via GPO
* Apply suggestions from code review
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com >
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
* Apply suggestions from code review
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com >
* Adjust Posh desc
* .
* Apply suggestions from code review
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
* .
* Apply suggestions from code review
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
* Update privilege_escalation_group_policy_scheduled_task.toml
* Update rules/windows/privilege_escalation_group_policy_iniscript.toml
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com >
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
2022-03-31 11:29:30 -03:00
a3d7427d29
[Security Content] Add Investigation Guides - 2 ( #1822 )
...
* Add Investigation Guides for Windows Rules - First half
* + 1/2
* Update impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml
* Update credential_access_mod_wdigest_security_provider.toml
* Apply suggestions from code review
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
* Update defense_evasion_amsienable_key_mod.toml
* Update defense_evasion_amsienable_key_mod.toml
* Apply suggestions from code review
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com >
* Update command_and_control_certutil_network_connection.toml
* Apply suggestions from code review
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com >
* Update collection_winrar_encryption.toml
* Apply suggestions from code review
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com >
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
2022-03-30 14:43:55 -03:00
940689576d
[New Rule] Account configured with never Expiring Password ( #1790 )
...
* Create persistence_nopasswd_account.toml
* Update persistence_nopasswd_account.toml
* Update persistence_nopasswd_account.toml
* .
* Update persistence_dontexpirepasswd_account.toml
* Update persistence_dontexpirepasswd_account.toml
2022-03-26 08:19:28 -03:00
cdb3dd6dbe
[Security Content] Add Investigation Guides ( #1799 )
...
* Update impact_backup_file_deletion.toml
* Update credential_access_seenabledelegationprivilege_assigned_to_user.toml
* Update defense_evasion_ms_office_suspicious_regmod.toml
* Update credential_access_posh_request_ticket.toml
* Update credential_access_disable_kerberos_preauth.toml
* Fix missing hyphen
* Update rules/windows/credential_access_posh_request_ticket.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
* Update rules/windows/credential_access_posh_request_ticket.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
* Apply suggestions from code review
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
* Apply suggestions from code review
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com >
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
* Update credential_access_posh_request_ticket.toml
* Apply suggestions from code review
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
* Remove extra line
* Apply suggestions from code review
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
* Lint and adjusts
* Apply suggestions from code review
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
Co-authored-by: benironside <91905639+benironside@users.noreply.github.com >
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
Co-authored-by: Joe Peeples <joe.peeples@elastic.co >
Co-authored-by: nastasha-solomon <79124755+nastasha-solomon@users.noreply.github.com >
2022-03-24 18:16:00 -03:00
df7bed4408
[New Rule] User account exposed to Kerberoasting ( #1789 )
...
* Create credential_access_spn_attribute_modified.toml
* Update credential_access_spn_attribute_modified.toml
* Update non-ecs-schema.json
* Update rules/windows/credential_access_spn_attribute_modified.toml
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com >
2022-03-23 16:31:47 -03:00
c254d0de8b
[New Rule] Suspicious Remote Registry Access via SeBackupPrivilege ( #1783 )
...
* [New Rule] Suspicious Remote Registry Access via SeBackupPrivilege
https://github.com/mpgn/BackupOperatorToDA
https://raw.githubusercontent.com/Wh04m1001/Random/main/BackupOperators.cpp
Detection mainly occurs on AD/DC side :
EQL
```
sequence by host.id, winlog.event_data.SubjectLogonId with maxspan=1m
[iam where event.action == "logged-in-special" and
winlog.event_data.PrivilegeList : "SeBackupPrivilege"]
[any where event.action == "Detailed File Share" and winlog.event_data.RelativeTargetName : "winreg"]
```
```
"sequences" : [
{
"join_keys" : [
"83989f29-8447-4b3c-a54b-4a0f7e5a4872",
"0x2a23a5"
],
"events" : [
{
"_index" : ".ds-logs-system.security-default-2022.02.11-000001",
"_id" : "L68HAn8BQQK22TUvoE_k",
"_source" : {
"agent" : {
"name" : "01566s-win16-ir",
"id" : "0517bf72-e8ae-4f53-bc09-cdf3428aa683",
"type" : "filebeat",
"ephemeral_id" : "26383f4e-4412-4aa4-8ed4-7e729fb593e8",
"version" : "8.0.0"
},
"winlog" : {
"computer_name" : "01566s-win16-ir.threebeesco.com",
"process" : {
"pid" : 624,
"thread" : {
"id" : 756
}
},
"keywords" : [
"Audit Success"
],
"logon" : {
"id" : "0x2a23a5"
},
"channel" : "Security",
"event_data" : {
"SubjectUserName" : "samir",
"SubjectDomainName" : "3B",
"SubjectLogonId" : "0x2a23a5",
"PrivilegeList" : [
"SeBackupPrivilege",
"SeRestorePrivilege"
],
"SubjectUserSid" : "S-1-5-21-308926384-506822093-3341789130-220106"
},
"opcode" : "Info",
"record_id" : "2987813",
"task" : "Special Logon",
"event_id" : "4672",
"provider_guid" : "{54849625-5478-4994-A5BA-3E3B0328C30D}",
"api" : "wineventlog",
"provider_name" : "Microsoft-Windows-Security-Auditing"
},
"log" : {
"level" : "information"
},
"elastic_agent" : {
"id" : "0517bf72-e8ae-4f53-bc09-cdf3428aa683",
"version" : "8.0.0",
"snapshot" : false
},
"message" : """Special privileges assigned to new logon.
Subject:
Security ID: S-1-5-21-308926384-506822093-3341789130-220106
Account Name: samir
Account Domain: 3B
Logon ID: 0x2A23A5
Privileges: SeBackupPrivilege
SeRestorePrivilege""",
"input" : {
"type" : "winlog"
},
"@timestamp" : "2022-02-16T10:15:26.330Z",
"ecs" : {
"version" : "1.12.0"
},
"related" : {
"user" : [
"samir"
]
},
"data_stream" : {
"namespace" : "default",
"type" : "logs",
"dataset" : "system.security"
},
"host" : {
"hostname" : "01566s-win16-ir",
"os" : {
"build" : "14393.3659",
"kernel" : "10.0.14393.3659 (rs1_release_1.200410-1813)",
"name" : "Windows Server 2016 Datacenter",
"type" : "windows",
"family" : "windows",
"version" : "10.0",
"platform" : "windows"
},
"ip" : [
"172.16.66.36",
"fe80::ffff:ffff:fffe",
"fe80::5efe:ac10:4224"
],
"name" : "01566s-win16-ir.threebeesco.com",
"id" : "83989f29-8447-4b3c-a54b-4a0f7e5a4872",
"mac" : [
"00:50:56:24:6c:d2",
"00:00:00:00:00:00:00:e0",
"00:00:00:00:00:00:00:e0"
],
"architecture" : "x86_64"
},
"event" : {
"agent_id_status" : "verified",
"ingested" : "2022-02-16T10:15:28Z",
"code" : "4672",
"provider" : "Microsoft-Windows-Security-Auditing",
"created" : "2022-02-16T10:15:27.675Z",
"kind" : "event",
"action" : "logged-in-special",
"category" : [
"iam"
],
"type" : [
"admin"
],
"dataset" : "system.security",
"outcome" : "success"
},
"user" : {
"domain" : "3B",
"name" : "samir",
"id" : "S-1-5-21-308926384-506822093-3341789130-220106"
}
}
},
{
"_index" : ".ds-logs-system.security-default-2022.02.11-000001",
"_id" : "Mq8HAn8BQQK22TUvoE_k",
"_source" : {
"agent" : {
"name" : "01566s-win16-ir",
"id" : "0517bf72-e8ae-4f53-bc09-cdf3428aa683",
"ephemeral_id" : "26383f4e-4412-4aa4-8ed4-7e729fb593e8",
"type" : "filebeat",
"version" : "8.0.0"
},
"winlog" : {
"computer_name" : "01566s-win16-ir.threebeesco.com",
"process" : {
"pid" : 4,
"thread" : {
"id" : 1176
}
},
"keywords" : [
"Audit Success"
],
"logon" : {
"id" : "0x2a23a5"
},
"channel" : "Security",
"event_data" : {
"ShareName" : """\\*\IPC$""",
"IpPort" : "50071",
"SubjectLogonId" : "0x2a23a5",
"AccessMask" : "0x12019f",
"ObjectType" : "File",
"SubjectUserName" : "samir",
"AccessReason" : "-",
"SubjectDomainName" : "3B",
"IpAddress" : "172.16.66.25",
"AccessMaskDescription" : [
"List Object",
"Read Property",
"Create Child",
"Control Access",
"Delete Child",
"List Contents",
"SELF",
"SYNCHRONIZE",
"READ_CONTROL"
],
"RelativeTargetName" : "winreg",
"AccessList" : """%%1538
%%1541
%%4416
%%4417
%%4418
%%4419
%%4420
%%4423
%%4424
""",
"SubjectUserSid" : "S-1-5-21-308926384-506822093-3341789130-220106"
},
"opcode" : "Info",
"record_id" : "2987816",
"event_id" : "5145",
"task" : "Detailed File Share",
"provider_guid" : "{54849625-5478-4994-A5BA-3E3B0328C30D}",
"api" : "wineventlog",
"provider_name" : "Microsoft-Windows-Security-Auditing"
},
"log" : {
"level" : "information"
},
"elastic_agent" : {
"id" : "0517bf72-e8ae-4f53-bc09-cdf3428aa683",
"version" : "8.0.0",
"snapshot" : false
},
"message" : """A network share object was checked to see whether client can be granted desired access.
Subject:
Security ID: S-1-5-21-308926384-506822093-3341789130-220106
Account Name: samir
Account Domain: 3B
Logon ID: 0x2A23A5
Network Information:
Object Type: File
Source Address: 172.16.66.25
Source Port: 50071
Share Information:
Share Name: \\*\IPC$
Share Path:
Relative Target Name: winreg
Access Request Information:
Access Mask: 0x12019F
Accesses: READ_CONTROL
SYNCHRONIZE
ReadData (or ListDirectory)
WriteData (or AddFile)
AppendData (or AddSubdirectory or CreatePipeInstance)
ReadEA
WriteEA
ReadAttributes
WriteAttributes
Access Check Results:
-""",
"input" : {
"type" : "winlog"
},
"@timestamp" : "2022-02-16T10:15:26.336Z",
"ecs" : {
"version" : "1.12.0"
},
"data_stream" : {
"namespace" : "default",
"type" : "logs",
"dataset" : "system.security"
},
"host" : {
"hostname" : "01566s-win16-ir",
"os" : {
"build" : "14393.3659",
"kernel" : "10.0.14393.3659 (rs1_release_1.200410-1813)",
"name" : "Windows Server 2016 Datacenter",
"family" : "windows",
"type" : "windows",
"version" : "10.0",
"platform" : "windows"
},
"ip" : [
"172.16.66.36",
"fe80::ffff:ffff:fffe",
"fe80::5efe:ac10:4224"
],
"name" : "01566s-win16-ir.threebeesco.com",
"id" : "83989f29-8447-4b3c-a54b-4a0f7e5a4872",
"mac" : [
"00:50:56:24:6c:d2",
"00:00:00:00:00:00:00:e0",
"00:00:00:00:00:00:00:e0"
],
"architecture" : "x86_64"
},
"event" : {
"agent_id_status" : "verified",
"ingested" : "2022-02-16T10:15:28Z",
"code" : "5145",
"provider" : "Microsoft-Windows-Security-Auditing",
"kind" : "event",
"created" : "2022-02-16T10:15:27.675Z",
"action" : "Detailed File Share",
"dataset" : "system.security",
"outcome" : "success"
}
}
}
]
},
```
* Update non-ecs-schema.json
* Update rules/windows/credential_access_suspicious_winreg_access_via_sebackup_priv.toml
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com >
2022-03-23 19:42:03 +01:00
096723b2a1
[Rule Tuning] Symbolic Link to Shadow Copy Created ( #1830 )
...
* fixed duplicated file name
* deprecated Symbolic Link to Shadow Copy Created as it may be prone to FP and the intrusion steps are covered with NTDS or SAM Database File Copied
* moved rule back to production, added investigation notes and sequencing to EQL query
* added related rule 3bc6deaa-fbd4-433a-ae21-3e892f95624f to investigation notes
* updating with minor changes
* adjusted related rules
* adjusted investigation notes
* Update rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com >
* Update rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com >
* Update rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com >
* TOML linted and adjusted updated date
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com >
2022-03-18 11:08:29 -04:00
22dd7f0ada
Deprecate PrintNightmare Rules ( #1852 )
2022-03-17 19:39:36 -03:00
a6edb7cfcf
Update defense_evasion_posh_process_injection.toml ( #1838 )
...
Co-authored-by: Colson Wilhoit <48036388+DefSecSentinel@users.noreply.github.com >
2022-03-17 19:37:42 -03:00
e0f8f61ca0
Update persistence_user_account_added_to_privileged_group_ad.toml ( #1845 )
2022-03-16 13:06:04 -03:00
b5f06f455c
Update defense_evasion_microsoft_defender_tampering.toml ( #1837 )
2022-03-14 20:07:39 -03:00
53fbc50ea1
[New Rule] AdminSDHolder SDProp Exclusion Added ( #1795 )
...
* AdminSDHolder SDProp Exclusion Added Initial Rule
* Update persistence_sdprop_exclusion_dsheuristics.toml
* Update rules/windows/persistence_sdprop_exclusion_dsheuristics.toml
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com >
2022-03-10 14:17:01 -03:00
Terrance DeJesus